membrane-soap

maintainer Muflone · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is a prebuilt binary (Eclipse RCP application with JARs and a native executable 'membrane-client') fetched from url.muflone.com, which is the maintainer's personal redirect/hosting domain rather than the official GitHub releases page (https://github.com/membrane/client/releases). The official upstream does publish Linux GTK x86_64 tarballs on GitHub releases, so there is no technical reason to proxy through a personal domain. This creates a genuine supply-chain concern: the maintainer controls the redirect target and could substitute a different binary without changing the PKGBUILD. The sha256sum provides integrity for whatever is currently served, but does not prove the binary matches the official upstream release. Since this is an executed binary (native launcher + JARs) from a non-official host, the medium rating is appropriate and not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://url.muflone.com/membrane-client-linux.gtk.x86_64-${pkgver}.tar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is a prebuilt binary (Eclipse RCP application with JARs and a native executable 'membrane-client') fetched from url.muflone.com, which is the maintainer's personal redirect/hosting domain rather than the official GitHub releases page (https://github.com/membrane/client/releases). The official upstream does publish Linux GTK x86_64 tarballs on GitHub releases, so there is no technical reason to proxy through a personal domain. This creates a genuine supply-chain concern: the maintainer controls the redirect target and could substitute a different binary without changing the PKGBUILD. The sha256sum provides integrity for whatever is currently served, but does not prove the binary matches the official upstream release. Since this is an executed binary (native launcher + JARs) from a non-official host, the medium rating is appropriate and not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Muflone http://www.muflone.com/contacts/english/
    
      2
    
      3pkgname=membrane-soap
    
      4pkgver=1.3.1
    
      5pkgrel=2
    
      6pkgdesc="Generic SOAP client with a dynamic form generator for SOAP requests."
    
      7arch=('x86_64')
    
      8url="https://github.com/membrane/client"
    
      9license=('APACHE')
    
      10makedepends=('unzip')
    
      11depends=('java-runtime' 'desktop-file-utils')
    
      12source=("http://url.muflone.com/membrane-client-linux.gtk.x86_64-${pkgver}.tar"
    
      13        "${pkgname}.desktop")
    
      14sha256sums=('12b981a3b773879fab8345bea279e553a33079ea226976146c5ed001e7cf27e7'
    
      15            '1ec31aea2471f17b95b0512f3c80d510132bedca15878696e67094b3fe9fe173')
    
      16
    
      17package() {
    
      18  # Install the desktop file
    
      19  install -m 755 -d "${pkgdir}/usr/share/applications"
    
      20  install -m 755 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      21  # Copy all the required files
    
      22  cd "linux.gtk.x86_64"
    
      23  install -m 755 -d "${pkgdir}/usr/lib/${pkgname}"
    
      24  cp -r "configuration" "plugins" "membrane-client" "membrane-client.ini" "${pkgdir}/usr/lib/${pkgname}"
    
      25  # Create the symbolic link to the executable
    
      26  install -m 755 -d "${pkgdir}/usr/bin"
    
      27  ln -s "/usr/lib/${pkgname}/membrane-client" "${pkgdir}/usr/bin/${pkgname}"
    
      28  # Install the icon
    
      29  unzip -q -o -j plugins/com.predic8.rcp.membrane_client_${pkgver}.jar "icons/logo32.png"
    
      30  install -m 755 -d "${pkgdir}/usr/share/pixmaps"
    
      31  install -m 644 "logo32.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2